Analysis
- max time kernel
144s - max time network
145s - platform
windows10_x64 - resource
win10v20210410 - submitted
07/05/2021, 13:03
Static task
static1
Behavioral task
behavioral1
Sample
9afd241b_by_Libranalysis.dll
Resource
win7v20210410
windows7_x64
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
9afd241b_by_Libranalysis.dll
Resource
win10v20210410
windows10_x64
0 signatures
0 seconds
General
- Target 9afd241b_by_Libranalysis.dll
- Size 162KB
- Sample210507-621kd6apms
- SHA256 8ea04ca3e672c82441c9645dea0d797d7654ffb7d346b51ea2ab4032efd6b60a
- MD5 9afd241b784d383d212e78018a586ddc
- SHA1 56bf283f5799aa661a43f6e93ae61bd67a8e1765
- SHA512 0e298e172550dbef66323d0a55b0cce5f4817504cc40965dd8dd6a46a355a9b8df12d9252389a1658a3e0922102124eb07f3e96bcc337d5d1312700f3928952f
- MD5 SHA1 SHA512
Score
10/10
Malware Config
Signatures
- Suspicious use of NtCreateProcessExOtherParentProcess 1 IoCs
description pid Process procid_target PID 2080 created 2880 2080 WerFault.exe 72 - Program crash 2 IoCs
pid pid_target Process procid_target 2160 2880 WerFault.exe 72 2080 2880 WerFault.exe 72 - Suspicious behavior: EnumeratesProcesses 28 IoCs
pid Process 2160 WerFault.exe 2160 WerFault.exe 2160 WerFault.exe 2160 WerFault.exe 2160 WerFault.exe 2160 WerFault.exe 2160 WerFault.exe 2160 WerFault.exe 2160 WerFault.exe 2160 WerFault.exe 2160 WerFault.exe 2160 WerFault.exe 2160 WerFault.exe 2160 WerFault.exe 2080 WerFault.exe 2080 WerFault.exe 2080 WerFault.exe 2080 WerFault.exe 2080 WerFault.exe 2080 WerFault.exe 2080 WerFault.exe 2080 WerFault.exe 2080 WerFault.exe 2080 WerFault.exe 2080 WerFault.exe 2080 WerFault.exe 2080 WerFault.exe 2080 WerFault.exe - Suspicious use of AdjustPrivilegeToken 4 IoCs
description pid Process Token: SeRestorePrivilege 2160 WerFault.exe Token: SeBackupPrivilege 2160 WerFault.exe Token: SeDebugPrivilege 2160 WerFault.exe Token: SeDebugPrivilege 2080 WerFault.exe - Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 3172 wrote to memory of 2880 3172 rundll32.exe 72 PID 3172 wrote to memory of 2880 3172 rundll32.exe 72 PID 3172 wrote to memory of 2880 3172 rundll32.exe 72
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\9afd241b_by_Libranalysis.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:3172 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\9afd241b_by_Libranalysis.dll,#12⤵PID:2880
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2880 -s 6163⤵
- Program crash
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2160
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2880 -s 6363⤵
- Suspicious use of NtCreateProcessExOtherParentProcess
- Program crash
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2080
-
-